                :session (assoc (req :session) :user-id (user :id))
                :body ""}))))))
 
+  (POST "/logout" req
+    {:status 200 :session nil}))
+
+(defroutes api-routes
   (POST "/auth" req
     (if-let [user-id (let [{:keys [email password]} (req :params)]
                        (when (and email password)
                          (db/with-conn (db/authenticate-user email password))))]
       {:status 200 :session (assoc (req :session) :user-id user-id)}
-      {:status 401}))
-  (POST "/logout" req
-    {:status 200 :session nil}))
+      {:status 401})))
 
 (defroutes resource-routes
   (resources "/"))

  (:require [org.httpkit.server :refer [run-server]]
            [compojure.route :refer [resources]]
            [compojure.core :refer [GET POST routes defroutes context]]
            [ring.middleware.defaults :refer [wrap-defaults secure-site-defaults site-defaults]]
            [ring.middleware.edn :refer [wrap-edn-params]]
            [clojure.string :as string]
            [clojure.tools.nrepl.server :as nrepl]

    (let [fail {:status 400 :headers {"Content-Type" "text/plain"}}]
      (cond
        (string/blank? password) (assoc fail :body "Must provide a password")
        (not (invites/verify-hmac hmac (str now token invite_id email))) (assoc fail :body "Invalid HMAC")
        (string/blank? invite_id) (assoc fail :body "Invalid invitation ID")
        ; TODO: be smarter about this
        (not (#{"image/jpeg" "image/png"} (:content-type avatar))) (assoc fail :body "Invalid image")

        :else
        (let [invite (db/with-conn (db/get-invite (java.util.UUID/fromString invite_id)))]
